chore: stricter access to testremote endpoint

Signed-off-by: Benjamin Gaussorgues <[email protected]>
nextcloud · Nov 28, 2024 · e39137d · e39137d
1 parent b1ffafc
commit e39137d
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/apps/files_sharing/lib/Controller/ExternalSharesController.php b/apps/files_sharing/lib/Controller/ExternalSharesController.php
@@ -118,9 +118,10 @@ protected function testUrl($remote, $checkVersion = false) {
 	 *
 	 * @param string $remote
 	 * @return DataResponse
+	 * @AnonRateThrottle(limit=5, period=120)
 	 */
 	public function testRemote($remote) {
-		if (str_contains($remote, '#') || str_contains($remote, '?') || str_contains($remote, ';')) {
+		if (preg_match('%[!#$&\'()*+,;=?@[\]]%', $remote)) {
 			return new DataResponse(false);
 		}